OBSERVED (from the diff): DenormalDisabler is an RAII guard used around WebAudio rendering to put the CPU floating-point environment into flush-to-zero / denormals-are-zero mode (denormals badly hurt audio DSP performance). The pre-patch implementation defined the guard only for OS(WINDOWS) && COMPILER(MSVC) or COMPILER(GCC_COMPATIBLE) && defined(__SSE__) (x86), wrapping the whole class in #ifdef HAVE_DENORMAL; on ARM (Apple Silicon / iOS / iPadOS) HAVE_DENORMAL was undefined, so there was effectively no working, correctly-scoped denormal control on Apple’s primary architecture. Its constructor unconditionally OR’d flush bits into the status word (setCSR(m_savedCSR | 0x8040/0x8000)) and the destructor wrote back m_savedCSR, with x86 detection done via inline stmxcsr/ldmxcsr and an fxsave-based DAZ probe.

The fix rewrites it: it reads the status word once (readStatusWord: stmxcsr on x86, mrs FPCR on ARM64, vmrs FPSCR on ARM), records m_disablingActivated = areDenormalsEnabled(m_savedCSR), changes the mode ONLY when denormals were actually enabled, and in the destructor restores the exact saved word only if it changed it; HAVE_DENORMAL moves into PlatformHave.h for X86_SSE2/ARM/ARM64 and a manual flushDenormalFloatToZero fallback covers platforms without hardware support. The net effect is a precisely-scoped, save-exactly/restore-exactly FP-environment guard that is correct on ARM as well as x86. INFERENCE (mechanism, not shown by the diff): the security significance is the interaction between this non-IEEE FP mode and JIT-compiled JavaScript. AudioWorklet executes author JS on the audio rendering thread where the denormal guard is active, and the DFG/FTL JIT constant-folds and range-analyzes floating-point operations assuming standard IEEE-754 semantics. If the flush-to-zero/denormals-are-zero mode is left active, mis-scoped, or (on ARM) uncontrolled while JIT-compiled JS runs, runtime FP results (denormals becoming zero, changed comparisons) diverge from the values the optimizer proved at compile time, breaking a JIT soundness invariant; such a divergence can be turned into a type confusion where a value the compiler treated as a specific type/shape differs at runtime, leading to memory corruption.

The patch removes that divergence by making the FP-mode change tightly scoped and architecture-correct so it cannot bleed into JIT-compiled code with mismatched assumptions.

The patch itself is a correctness/scoping fix to the audio FP-environment guard (precise save/restore, only-when-needed, and a previously-absent ARM implementation). Its security weight — reflected in the advisory’s ’type confusion could lead to memory corruption’ — comes from the inferred interaction between a mis-scoped flush-to-zero FP mode and JIT-compiled JavaScript (notably AudioWorklet on the same thread), where an FP-semantics mismatch can break JIT soundness into a type confusion and thence memory corruption. That exploitation chain is reasoned inference, not shown by the diff; what the diff establishes is the removal of the FP-mode divergence. Confined to the WebContent process. Rated medium (CVSS per NVD).